The entry table lists a module’s entry points: the functions other modules can import, its window procedures, and others that only the module itself refers to through relocations. Each entry point has a number, its ordinal, counted from 1 through the whole table. The name tables give names to some of the ordinals.
Bundles
The table is at ne_enttab
from the start of the NE header, ne_cbenttab bytes long. It is a run of
bundles, each a group of entries of the same kind:
| Offset | Size | Field | Meaning |
|---|---|---|---|
| 0 | 1 | count | The number of entries in the bundle; 0 ends the table. |
| 1 | 1 | type | What the entries are; see below. |
| 2 | … | entries | count entries, each of the size the type gives. |
| Type | Entries | Each entry |
|---|---|---|
0x00 | None: the bundle skips count ordinals that have no entry point. | — |
0x01–0xFD | Entry points in that fixed segment. | 3 bytes: flags (1), offset (2) |
0xFE | Constants rather than addresses (as Wine reads them). | 3 bytes: flags (1), value (2) |
0xFF | Entry points in movable segments. | 6 bytes: flags (1), CD 3F (2), segment number (1), offset (2) |
The two bytes CD 3F in a movable entry are the instruction
INT 3Fh, through which Windows loads the segment when the entry is called
and the segment is not yet in memory.
The flags byte of every entry:
| Bits | Meaning |
|---|---|
0x01 | Exported: other modules may import it. |
0x02 | Uses the shared (global) data segment. |
0xF8 | The number of parameter words, for OS/2’s ring transitions. |
The explorer lists every entry point in its Entry points table: ordinal, name, segment and offset, and whether it is exported. It marks each one in the code.
Worked example
WINMINE.EXE’s entry table, at 0x579, is one bundle of 5 movable entries:
00000579 05 FF 01 CD 3F 01 32 04 01 CD 3F 01 13 09 01 CD ....?.2...?.....
00000589 3F 01 30 0A 01 CD 3F 01 05 0B 00 CD 3F 01 00 00 ?.0...?.....?...
00000599 00 .0xFF, five 6-byte entries, and the 0 that ends the table| Ordinal | Flags | Segment:offset | Name |
|---|---|---|---|
| 1 | 0x01, exported | 1:0432 | MAINWNDPROC |
| 2 | 0x01, exported | 1:0913 | PREFDLGPROC |
| 3 | 0x01, exported | 1:0A30 | BESTDLGPROC |
| 4 | 0x01, exported | 1:0B05 | ENTERDLGPROC |
| 5 | 0x00 | 1:0000 | — |
The names come from the non-resident
name table. TEST1.EXE’s table starts 2D FF 00 CD 3F 02 0B 0E: 45
movable entries, the first, ordinal 1, not exported, at segment 2, offset
0x0E0B.